Privacy Policy

01

Who We Are

ReachMeridian LLC ("Meridian," "we," "us," or "our") is a New Jersey limited liability company operating under the trade name Meridian. We operate reachmeridian.com (the "Public Site") and portal.reachmeridian.com (the "Member Portal"), collectively referred to as the "Sites."

Meridian provides private, invitation-only music development and coaching services. This Privacy Policy applies to information collected through the Sites and in connection with our programs and services. This is the authoritative version. Where any other copy of this policy appears, this version controls.

02

Information We Collect

Information You Provide Directly

• Full legal name, username, and preferred name or stage name
• Email address and phone number
• Profile image (avatar), if you upload one
• Social media handles or artist profiles you choose to share
• Musical background, goals, and genre preferences
• Billing details you provide when paying an invoice. These are entered into our banking provider's payment page, not into our systems — we never receive or store your bank account or card numbers
• Signed agreements and contract information
• Your confirmation that you are eighteen (18) years of age or older, recorded with the date you gave it

Work You Submit

If you submit music or other material through the Member Portal, we store the file itself along with the title you give it, any notes you attach, its review status, and the written feedback we return to you. Submissions you make for a listening party are also linked to that event.

Information Collected Automatically

• IP address, including the originating IP address forwarded to us by our network provider
• Browser type, operating system, device type, and user-agent string
• Pages visited, time spent on pages, and referring URLs
• Date and time of access

Sign-In Records

We keep a record of sign-in attempts to the Member Portal — including attempts that fail. Each record contains the username entered, whether the attempt succeeded, the reason it failed, the IP address, the user-agent string, and the time. We also record the date of your most recent sign-in and a running count of successful sign-ins.

We keep these because they are how we detect someone trying to break into your account. Because a failed attempt is recorded even when the username entered was not yours, this is the one category of data we may hold about a person who is not a member.

Member Portal Activity

• Sign-in credentials — passwords are hashed with bcrypt and are never stored in a form we or anyone else can read
• Session bookings, including which session slot you reserved and when
• Session logs, written feedback, and progress documentation
• Listening party attendance responses (RSVPs)
• Votes you cast on submitted work
• Files shared with you, and records of when you downloaded them
• Handbook access records
• Membership change requests and account-closure requests you submit

Summary Table

03

How We Use Your Information

• To provide our services — scheduling and confirming sessions, tracking progress, reviewing submitted work, delivering feedback, and administering membership
• To communicate with you — invitations, password resets, session reminders, programme updates, invoices, and administrative notices
• To process payments — issuing and collecting invoices for membership fees, session fees, and transfer fees
• To keep accounts secure — detecting and blocking brute-force sign-in attempts, rate-limiting abuse, and investigating suspected account compromise
• To confirm eligibility — verifying that members are eighteen (18) or older, which our agreements require
• To maintain records — keeping documentation required for our business operations, including signed contracts and financial records
• To operate and improve the Sites — monitoring performance, diagnosing technical faults, and improving how the Sites work
• To enforce our policies — addressing violations of our Terms & Conditions and Membership Agreements
• To comply with legal obligations — retaining records as required by law and responding to lawful requests

We do not use your information for automated decision-making, profiling, targeted advertising, or any purpose unrelated to running the programme.

04

How We Share Your Information

We do not sell or rent your personal information. We share it only in the limited circumstances below.

Service Providers

These are the outside companies that handle your information on our behalf. Each accesses only what it needs to do its job.

• Cloudflare — network, security, and content delivery for both Sites. All traffic to the Sites passes through Cloudflare, which terminates the encrypted connection, filters malicious requests, and forwards your IP address to us. Cloudflare therefore sees the technical information described in Section 02.
• Google (Google Workspace) — delivery of our email, and encrypted backup storage
• Mercury — business banking and invoicing. When you pay an invoice, your name, email address, and the bank or card details you enter go to Mercury. They do not pass through us
• QuickBooks — accounting and financial record-keeping. Receives invoice and payment records — your name, the amount, and the date — after payment
• DocuSign — electronic signature processing for agreements

These providers are permitted to use your information only to perform services for us, and are contractually required to protect it.

Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Meridian, its members, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of ReachMeridian LLC, your information may transfer as part of that transaction. You will be notified by email or by notice on the Sites.

05

Where Your Information Lives

We think you should know this, because it is unusual and it is to your benefit.

The Member Portal runs on infrastructure we own and operate ourselves. Your account records, session logs, bookings, submissions, and feedback are held in a PostgreSQL database that is not reachable from the public internet. Files you upload — audio, documents, avatars — are written to disk on that same infrastructure and are never served directly by the web server; every download passes through an authenticated endpoint that checks it is really you first.

We do not use a third-party cloud database, a third-party file host, or an analytics platform. The list in Section 04 is the complete set of outside companies that touch your information.

06

Data Retention

We keep personal information only as long as we need it, and thereafter as law or our legitimate business interests require.

• Active members: retained for the membership term, plus five (5) years for financial and contractual records
• Former members: identifying information retained for three (3) years after termination; financial records for seven (7) years, per standard accounting practice
• Submitted work: retained for the membership term and deleted on request thereafter, subject to any rights or obligations surviving under your Membership Agreement
• Sign-in records: retained for twelve (12) months, then deleted
• Site visitors: automatically collected technical data retained for up to twelve (12) months
• Confidentiality obligations: records relating to the session location and to the identity of Meridian's principal are maintained indefinitely under our security protocols

On request we will delete personal information we are not legally or contractually required to keep.

07

Security

We implement technical and organisational measures appropriate to the sensitivity of what we hold:

• TLS encryption for all data in transit
• Passwords hashed with bcrypt; plain-text passwords are never stored and cannot be recovered by us or by anyone who obtained our database
• Signed authentication tokens for the Member Portal, with shorter lifetimes for administrative accounts than for member accounts, and a mechanism that invalidates every outstanding session immediately if we suspect a key has leaked
• Uploaded files validated by inspecting the file's actual contents, not merely its name or extension, so a renamed executable cannot masquerade as audio
• Member files stored outside the web server's reach and delivered only through authenticated endpoints
• Rate limiting and brute-force protection on all sign-in endpoints
• Security headers, firewalling, and network-level filtering in front of both Sites
• Encrypted backups

No method of transmission or storage is completely secure, and we do not claim otherwise. If you believe your account has been compromised, contact us immediately at [email protected] and we will invalidate your sessions.

08

Cookies and Tracking

The Public Site uses no cookies for tracking, no analytics, and no advertising technology of any kind.

The Member Portal stores an authentication token in your browser's local storage to keep you signed in. It is necessary for the portal to work and is not used to track you. Clearing your browser storage signs you out.

Cloudflare may set cookies necessary for security and abuse prevention.

09

Third-Party Resources on the Sites

The Public Site loads nothing from a third-party server. Typefaces, stylesheets, scripts, and images are all served from our own domain. This is enforced automatically: our build refuses to publish a page that references an outside resource, and a separate check verifies it again before release.

Earlier versions of this policy disclosed that the Sites loaded typefaces from Google's servers. That is no longer the case; those files are now self-hosted and no request is made to Google when you view the Public Site.

Links to third-party platforms may appear on the Sites. We are not responsible for their privacy practices and encourage you to review their policies.

10

Your Rights

Subject to applicable law, you may exercise the following rights over your personal information:

• Confirm and access — ask whether we process your information and obtain a copy of it
• Correct — ask us to fix information that is inaccurate or incomplete
• Delete — ask us to delete your information, subject to the retention obligations in Section 06
• Portability — obtain your information in a portable, machine-readable format
• Opt out — direct us not to sell your personal data, not to process it for targeted advertising, and not to profile you for decisions producing legal or similarly significant effects. We do none of these things, so there is nothing to opt out of; the right is stated because you are entitled to it

New Jersey residents hold these rights under the New Jersey Data Privacy Act. Residents of other jurisdictions may hold equivalent rights; we apply this section to everyone regardless of where they live.

How to Exercise Them

Email [email protected]. We will respond within forty-five (45) days, and may extend once by a further forty-five (45) days where the request is complex, telling you why before the first period ends. We do not charge for this.

If We Say No

If we decline your request, we will tell you why. You may appeal that decision by replying to our response or writing to the same address with the word "Appeal" in the subject line. We will review the appeal and give you a written decision, with reasons, within forty-five (45) days. If we deny the appeal, we will provide you with a method to contact the New Jersey Division of Consumer Affairs to submit a complaint.

11

Age Requirement

Meridian is for adults. You must be eighteen (18) years of age or older to become a member. Account activation requires you to confirm your age, and we record the date of that confirmation.

The Sites are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account.

If you are a parent or guardian and believe a minor has provided us with information, contact us at [email protected] and we will remove it.

12

Copyright Complaints (DMCA)

Members can upload recordings and other material to the Member Portal. If you own copyright in a work and believe it has been stored on our systems without authorisation, you may notify our designated agent. Material we remove in response is deleted from the systems described in Section 05, which is why this appears in a privacy policy at all.

Designated Agent

The full procedure lives in our Terms & Conditions, Section 13 — what a notification must contain under 17 U.S.C. § 512(c)(3), how counter-notification works under § 512(g)(3), and our repeat-infringer policy. It is stated once, there, so the two documents cannot drift apart.

Two things worth knowing before you send one. We do not review member uploads for infringement before they are stored, so a notice is how we learn of a problem. And knowingly misrepresenting that material is infringing exposes you to liability for damages, including costs and legal fees, under 17 U.S.C. § 512(f).

13

Changes to This Policy

We may update this Privacy Policy. When we do, we will revise the effective date and version number at the top of this page. For active members, material changes will be communicated by email to the address on file. Your continued use of the Sites after an updated policy is posted constitutes acceptance of the changes.

Changes in this version (1.1): corrected the statement about third-party typefaces, which was no longer accurate; disclosed Cloudflare as a service provider; removed a distribution provider we had not engaged; documented sign-in records, bookings, submissions, votes, and other portal data we collect; raised the minimum age to eighteen and removed the provision for minors; added New Jersey Data Privacy Act rights and an appeals process; added the designated agent for copyright complaints; and designated this as the authoritative version for both Sites.

14

Contact Us

Questions, concerns, or requests about this Policy or our data practices: